Cloudflare Zero Trust
Capability scores
Methodology →- Authentication
- 3.5
- SSO & Federation
- 4.0
- Authorization
- 4.5
- Lifecycle & Provisioning
- 3.0
- MFA & Passwordless
- 3.5
- Governance & Audit
- 4.0
- Developer Experience
- 4.5
- Deployment Flexibility
- 4.0
- Pricing Transparency
- 4.0
- Support & Ecosystem
- 4.5
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
Cloudflare Zero Trust is the access and security-service-edge half of Cloudflare One, which Cloudflare now calls its single-vendor SASE platform, sold by a public company (NYSE: NET) and run on a network Cloudflare says spans more than 300 cities. In 2026 it is the cheapest serious ZTNA stack with a published price, and the obvious choice for teams already on Cloudflare for DNS, CDN or WAF. Cloudflare was named a Visionary in the 2025 Gartner Magic Quadrant for SASE Platforms, not a Leader.
The core pieces are Access (identity-aware app access), Gateway (secure web gateway and DNS filtering), Tunnel (outbound-only cloudflared connectors) and the device agent, renamed the Cloudflare One Client (formerly WARP). Cloudflare acquired BastionZero in May 2024 to add server, Kubernetes and database access.
What it is good at
Value and time to deploy. Access puts an identity check in front of any app and supports all SAML and OIDC providers plus email one-time PINs, so it consumes your existing Okta or Microsoft Entra ID tenant. Tunnels connect private apps without a public IP. SCIM 2.0 deprovisions users and revokes their Access sessions when they are deactivated at the IdP. The same platform adds DNS filtering, email security and remote browser isolation, so one contract can retire a VPN, a web proxy and a DNS filter at once.
Where it falls short
Concentration risk is real, and Cloudflare's own record shows its corporate identity layer is a target. After the October 2023 Okta support system breach, Cloudflare failed to rotate one service token and three service accounts, which a suspected nation-state actor used in November 2023 to reach Jira, Confluence and Bitbucket (Cloudflare's write-up; our incident record). In August 2025 the Salesloft Drift OAuth token theft exposed Cloudflare support cases containing 104 customer API tokens, all rotated (Cloudflare). Neither touched Cloudflare's network, but both are static credential lessons.
SCIM does not create users; they appear only after device enrolment or first login. Lower tiers keep logs for 24 hours (Free) or 30 days, and deeper DLP, CASB and browser isolation are add-ons. It is not an identity provider.
Pricing
Published (checked 2026-11-05) on the Zero Trust plans page: a free tier at $0 for up to 50 users; Pay-as-you-go at $7 per user per month with no user cap; Contract at a custom annual per-user price with up to 6 months of log retention and Logpush.
Best for, and who should look elsewhere
Choose Cloudflare to replace VPNs with identity-aware access at strong value, especially if you already run Cloudflare. Choose Zscaler or Netskope for the largest SSE consolidations, or Tailscale for the simplest mesh VPN. See Cloudflare vs Zscaler, Tailscale vs Cloudflare and our zero trust rollout guide.
Bottom line
The best-value ZTNA from SMB to enterprise, with a real free plan, and the obvious pick if Cloudflare is already in your stack.
Cloudflare Zero Trust: frequently asked questions
- How much does Cloudflare Zero Trust cost?
- Cloudflare publishes three plans (checked 2026-11-05). The Free plan costs $0 for up to 50 users and includes ZTNA, the secure web gateway and the device client, with logs kept up to 24 hours. Pay-as-you-go is $7 per user per month with no user limit and 30 days of logs. The Contract plan is custom, priced as an annual price per user, with up to 6 months of logs, Logpush to a SIEM, and full DLP, CASB and browser isolation as add-ons. Free and Pay-as-you-go get only limited predefined DLP profiles and up to two read-only CASB integrations.
- Was Cloudflare breached through Okta?
- Twice affected, once breached. In October 2023 an attacker used session tokens from Okta's support system against Cloudflare, which detected and contained it. Then from 14 to 24 November 2023 an attacker Cloudflare believes was a nation state used one service token and three service account credentials taken in that Okta breach, which Cloudflare had failed to rotate, to reach its Atlassian Jira, Confluence and Bitbucket. Cloudflare said no customer data or systems were affected, disclosed on 1 February 2024 and rotated more than 5,000 production credentials.
- Was Cloudflare affected by the Salesloft Drift breach?
- Yes, in its Salesforce tenant, not its network. Cloudflare says the attacker accessed its Salesforce instance from 12 to 17 August 2025 through stolen Salesloft Drift OAuth tokens and exported support case text fields and customer contact details on 17 August; attachments were not taken. Cloudflare found 104 Cloudflare API tokens pasted into case text and rotated all of them, with no suspicious use found. It states that no Cloudflare services or infrastructure were compromised, and it notified affected customers on 2 September 2025.
- What should I check in a Cloudflare Zero Trust evaluation?
- Start with identity plumbing. Cloudflare Access works with any SAML or OIDC identity provider plus email one-time PINs, and SCIM 2.0 can deprovision users and sync groups, but SCIM does not create users: they appear only after enrolling a device or signing in to an Access app. Check log retention against your audit needs, since only the Contract plan keeps more than 30 days and exports to a SIEM. Confirm which DLP, CASB and browser isolation features need add-ons, and decide whether one provider for DNS, CDN and access is an acceptable concentration risk.
- What are the best Cloudflare Zero Trust alternatives?
- For the largest global SSE programmes, Zscaler and Netskope are the usual shortlists; Zscaler leads on scale and Netskope on inline data protection. Palo Alto Networks Prisma Access and Cisco Secure Access suit buyers already standardised on those firewall estates. For lighter, developer-led private access, Tailscale and Twingate deploy faster and cost less to run. Cloudflare's own advantage is a published price and a free plan for up to 50 users, which none of the enterprise SSE vendors offer.
Cloudflare Zero Trust comparisons
More Zero Trust vendors
All Zero Trust →- Tailscale4.5/5
- Zscaler4.5/5
- Cato Networks4.4/5
- Netskope4.3/5
- Palo Alto Prisma Access4.3/5
Related on Start with Identity
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVEWindows SMB Client improper authentication (tampering)
Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr
- CVEWindows SMB Kerberos reflection elevation of privilege
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- VendorZero Networks
specialist
- ExpertSPIFFE and SPIRE maintainer, co-author of Zero Trust Networks
Evan Gilman is a maintainer of SPIRE, the reference implementation of SPIFFE, and co-wrote O'Reilly's Zero Trust Networks. He was an engineer at Scytale, where
- ArticleTop 7 Open-Source Zero Trust and ZTNA Tools
The best open-source zero trust tools in 2026, from OpenZiti and Pomerium to Teleport, Headscale, NetBird, HashiCorp Boundary, and Authelia, compared on archite
By SWI Community Team · Last evaluated 2026-11-05
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.